From efdbdff75eaae7e6d3b115d3686c782aaf153378 Mon Sep 17 00:00:00 2001 From: Joe Leon Date: Thu, 25 Jan 2024 08:03:37 -0500 Subject: [PATCH] small updates to logic --- pkg/detectors/elasticcloud/elasticcloud.go | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/pkg/detectors/elasticcloud/elasticcloud.go b/pkg/detectors/elasticcloud/elasticcloud.go index 70f3ca59b..ca18c71e0 100644 --- a/pkg/detectors/elasticcloud/elasticcloud.go +++ b/pkg/detectors/elasticcloud/elasticcloud.go @@ -22,14 +22,14 @@ var _ detectors.Detector = (*Scanner)(nil) var ( defaultClient = common.SaneHttpClient() // Make sure that your group is surrounded in boundary characters such as below to reduce false positives. - keyPat = regexp.MustCompile(`([A-Za-z0-9+/=]{60})`) - domainPat = regexp.MustCompile(`([a-zA-Z0-9-.]+\.elastic-cloud\.com\:[0-9]{2,5})|([a-zA-Z0-9-.]+\.cloud\.es\.io\:[0-9]{2,5})`) + keyPat = regexp.MustCompile(`([A-Za-z0-9+/=]{60,100})`) + domainPat = regexp.MustCompile(`([a-zA-Z0-9-.]+\.elastic-cloud\.com\:[0-9]{2,5})|([a-zA-Z0-9-.]+\.cloud\.es\.io\:[0-9]{2,5})|([a-zA-Z0-9-.]+\.ip\.es\.io\:[0-9]{2,5})`) ) // Keywords are used for efficiently pre-filtering chunks. // Use identifiers in the secret preferably, or the provider name. func (s Scanner) Keywords() []string { - return []string{"cloud.es.io", "elastic-cloud.com"} + return []string{"cloud.es.io", "elastic-cloud.com", "ip.es.io"} } // FromData will find and optionally verify Elasticcloud secrets in a given set of bytes. @@ -61,7 +61,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result if err != nil { continue } - req.Header.Add("Authorization", "ApiKey "+key) + port := strings.Split(domainRes, ":")[1] + if port == "443" || port == "80" { + //Handle REST API Auth + req.Header.Add("Authorization", "Basic "+key) + } else { + //Handle Elastic Search Auth + req.Header.Add("Authorization", "ApiKey "+key) + } res, err := client.Do(req) if err == nil { defer res.Body.Close()